These are a good idea for large enterprise organizations. We are using a product called Securden which offers PAM features.

(But I much prefer keys/certs over passwords where possible.)